On 11 May 2026, between 19:20 and 19:26 UTC, someone published 84 malicious versions across 42 @tanstack/* npm packages. Six minutes, start to finish. @tanstack/react-router alone pulls north of 12 million weekly downloads, so the blast radius
Latest Posts
Malicious npm Packages With Valid SLSA Provenance: Inside the TanStack Attack
Replit: Who Captures the Value When Software Builds Itself?
An investor's research framework for AI-native software creation, distribution, unit economics and competitive defensibility Investment disclosure: I first invested in Replit in April 2022. This is an assessment of the business as it stood by March 2026, not a reconstruction
How do I get my website and content cited in AI answers?
You’ve optimised for Google. You’re ranking. But when your prospects ask ChatGPT or Perplexity for recommendations, your brand doesn’t show up. Instead, they see your competitors cited as sources, woven into the answer itself. This is the
Monzo: From Banking App to Banking Economics
Reassessing an early investment through the lens of customer economics, regulatory capital and valuation Investment disclosure: I first invested in Monzo in February 2016. This article is not a contemporaneous record of why I invested then; I have not reconstructed
The Great Visibility Shift: How AI Search Is Rewriting the Rules of Content Discovery
AI search is changing what it means to be "discoverable" on the internet. For two decades, content discovery meant ranking a page, winning a click, and converting that visitor on your site. Now, large language models and AI-powered search experiences
How to Turn ChatGPT and AI Engines Into One of Your Best Conversion Channels
A question I hear more and more is how ChatGPT decides which products to recommend. The short answer is that it doesn’t rank tools the way Google ranks pages. It learns from how the internet explains, compares, and contextualises
The rise of AI agents: A Look at the state of agentic AI in 2025
Artificial intelligence has been through plenty of “next big things.” A decade ago everyone was talking about deep learning; by 2023 we were drowning in large language models. Now, in the middle of 2025, the discourse has shifted again. This
How to validate my startup ideas before building: a practical guide
Before building your startup, it’s crucial to validate the idea. In this post, I share how to talk to potential customers, research the market, create a landing page, and test with an MVP or pre-sales. These steps help confirm demand, saving time and ensuring you're building something people want.